Fraud taxonomy

Fake trading platforms, guaranteed-yield offers and bogus funds.

Signature Guaranteed or fixed daily returns; withdrawals blocked behind a fee.

Typical indicators

DomainWallet addressTransactionURL

Evidence worth capturing

Screenshots of the dashboard and promised returns, deposit transaction hashes, and the platform domain.

Long-form relationship grooming leading to a fraudulent investment.

Signature Weeks of rapport before any investment is mentioned; app installed off-store.

Typical indicators

EntityDomainWallet addressSocial account

Evidence worth capturing

Chat history showing the grooming sequence, the app or site used, and every deposit address.

Cloned sites and messages that harvest seed phrases or credentials.

Signature Urgent wallet 'validation'; seed phrase or private key requested.

Typical indicators

URLDomainWallet address

Evidence worth capturing

The exact URL received, the message or email headers, and the wallet approval prompt.

Fake support staff, executives, brands or government officials.

Signature Support that contacts you first; payment to a personal wallet.

Typical indicators

EntitySocial accountWallet addressDomain

Evidence worth capturing

Profile links, message screenshots and any address given as an official payment channel.

Exchanges that display balances but block or fake withdrawals.

Signature Balance rises but withdrawals require tax, unlock or verification fees.

Typical indicators

DomainWallet addressTransaction

Evidence worth capturing

Account statements, the withdrawal error, and the deposit chain and address.

Second-stage fraud targeting people who already lost funds.

Signature Contact shortly after a first loss; upfront fee to 'release' funds.

Typical indicators

EntityDomainWallet address

Evidence worth capturing

The approach message, any fee invoice and the address the fee was sent to.

Emotional manipulation used to extract crypto transfers.

Signature Meeting is always deferred; requests escalate over time.

Typical indicators

EntitySocial accountWallet address

Evidence worth capturing

Relationship timeline, profile details, and the transfers requested.

Token or project teams removing liquidity or abandoning holders.

Signature Liquidity pulled or trading disabled; team channels wiped.

Typical indicators

Wallet addressTransactionDomainSocial account

Evidence worth capturing

Contract address, liquidity removal transaction and team channels before deletion.

Malicious approvals, drainer kits and trojanised wallet software.

Signature A single signature empties multiple assets at once.

Typical indicators

URLDomainWallet addressTransaction

Evidence worth capturing

The signed approval, drainer domain and destination address of the sweep.

Extortion payments demanded in cryptocurrency.

Signature Payment deadline with escalating demands.

Typical indicators

Wallet addressTransactionEntity

Evidence worth capturing

The ransom note, payment address and any negotiation channel.

Activity that does not fit the categories above.

Signature Does not match another category, but funds were solicited or taken.

Typical indicators

Wallet addressDomainURLEntity

Evidence worth capturing

Whatever documents the sequence of events, plus every identifier involved.